@ordewell/core 0.11.3 → 0.12.1

package/dist/{IRunner-DOMtDTVt.d.ts → eventStore-CTCSKS9E.d.ts}

@@ -1,119 +1,7 @@
 import { ChildProcess } from 'child_process';
-import { aS as Task, az as RunnerId, b6 as UsageRecord, aQ as SubagentOutcome, aA as RunnerSessionCost, i as DiscoveredModel, a$ as TaskSkillSnapshot, p as HandoffCheck } from './Task-BL4Idm9r.js';
+import { aB as PlannerAllowlist, b3 as RunnerId, az as PlanStatus, aj as LegacyPlanState, ay as PlanState, bk as SkillsService, bf as SkillInfo, aS as RepoGroupLayout, T as IWorktreeIsolation, ab as IsolationRun, X as IsolationHandoff, ax as PlanIsolation, ac as IsolationTaskRecord, bt as TaskIsolation, ag as IsolationView, a6 as IsolationRemoval, bp as Task, aH as PrepareIntent, aL as PreviousWork, J as HandoffCommit, a3 as IsolationOutcome, aP as RepairEvidence, bE as TreeSnapshot, bq as TaskDiffRead, br as TaskDiffResult, a2 as IsolationMergeResult, ai as LandedWork, b0 as RevertWatch, a9 as IsolationRevertResult, bG as UsageRecord, bm as SubagentOutcome, b4 as RunnerSessionCost, p as DiscoveredModel, bJ as VerificationCheck, bz as TaskSkillSnapshot, b7 as ScriptBody, I as HandoffCheck } from './Task-CxGgN6I0.js';
 import { z } from 'zod/v4';
 
-/** A script task's time limit when it sets none. */
-declare const DEFAULT_SCRIPT_TIMEOUT_MS: number;
-/** What a script task runs, its time limit filled in. */
-type ScriptBody = 
-/** Argument vectors run in order with no shell, stopping at the first that fails. */
-{
-    commands: string[][];
-    timeoutMs: number;
-}
-/** One script, run by the research shell's interpreter. */
- | {
-    script: string;
-    timeoutMs: number;
-};
-type BodyFields = Pick<Task, 'type' | 'commands' | 'script' | 'timeoutMs'>;
-/** The body a script task runs; null for any other task, or one whose body the plan's rules refuse. */
-declare function scriptBodyOf(task: BodyFields): ScriptBody | null;
-/**
- * An argument vector as a reader would type it in a shell: a word is quoted
- * only where it needs to be, and one holding a character a reader cannot see
- * is written with escapes (`$'…'`), so a command is always one line and reads
- * as what runs. For reading only; nothing runs it.
- */
-declare function commandLine(argv: readonly string[]): string;
-/**
- * A script task's body as the approval card shows it (ADR-0035), so the
- * consent is to what will run: each command on a line of its own, or the
- * script as written, then the time limit. A character a reader cannot see in
- * a script, but for its line breaks and tabs, is shown as its code.
- */
-declare function scriptBodyText(body: ScriptBody): string;
-/**
- * A script task as a row shows it: the body {@link scriptBodyText} gives the
- * approval card, so what the user read when consenting is what the plan lists.
- * A task whose body the plan's rules refuse says so rather than showing nothing.
- */
-declare function scriptTaskText(task: BodyFields): string;
-/** A time limit in the largest units it is a whole number of: "10 minutes", "90 seconds". */
-declare function timeLimitText(ms: number): string;
-
-/**
- * The planner's standing approvals (ADR-0026): what runs without asking
- * anyone, under every approval mode.
- *
- * One entry is one of:
- *
- *   - a **command rule**, `gh issue list` or `gcloud * * list`: the binary,
- *     then words matched against the command's leading arguments, the ones
- *     before its first flag. A command whose leading words match the rule's
- *     runs, whatever arguments follow — but the rule must spell out at least
- *     the words the command's approval scope holds (ADR-0008, T1), so
- *     `az group` never covers `az group delete`, and a one-word read takes a
- *     `*` for its argument (`kubectl get *`). `*` stands for one word, and
- *     inside a word for any run of characters (`describe-*`). An entry equal
- *     to a scope also matches that scope, as pre-approved scopes always did.
- *   - an **MCP tool rule**, `mcp:find-*`: a glob over the tool's own name,
- *     without the server, case-insensitive.
- *   - a **scope pattern**, anything starting with `/`, `~`, `http://`,
- *     `https://`, `web_search:`, `mcp__`, `mcp-server:` or a drive letter: matched against an approval's
- *     scope as ADR-0008 always matched pre-approved entries, `*` matching any
- *     run of characters.
- *
- * A leading `!` excludes instead, and an exclusion wins over every rule. A
- * command exclusion's words are looked for anywhere among the arguments, in
- * order, flags included and case ignored, so `!kubectl *secret*` and
- * `!* --endpoint*` hold wherever the word appears; a lone short flag (`-s`)
- * also holds inside a bundle (`-As`, `-shost`). `*` as its binary covers
- * every command.
- */
-/** The words a command rule is matched against: a lexed segment's binary and arguments. */
-interface CommandWords {
-    binary: string;
-    args: readonly string[];
-    /** How many leading arguments the command's approval scope holds; a rule must cover at least that many. */
-    scopeWords?: number;
-}
-interface RuleWord {
-    matches: (word: string) => boolean;
-    wildcard: boolean;
-}
-interface CommandRule {
-    text: string;
-    binary: string;
-    words: RuleWord[];
-}
-interface PlannerAllowlist {
-    commands: CommandRule[];
-    commandExclusions: CommandRule[];
-    tools: RegExp[];
-    toolExclusions: RegExp[];
-    scopes: RegExp[];
-    scopeExclusions: RegExp[];
-}
-declare function parseAllowlist(entries: readonly string[]): PlannerAllowlist;
-/** The rule that lets this command run unasked, or undefined when none does or an exclusion holds. */
-declare function commandAllowedBy(list: PlannerAllowlist, command: CommandWords): string | undefined;
-/** Whether an MCP tool, by its own name without the server, runs unasked. */
-declare function toolAllowed(list: PlannerAllowlist, tool: string): boolean;
-/** Whether an approval scope — a directory, an origin, a tool's full name — is pre-approved. */
-declare function scopeAllowed(list: PlannerAllowlist, scope: string): boolean;
-/**
- * Read-only command families that are safe to run unasked: they read, never
- * write a file or change a resource, and need no argument that runs code.
- * Absent on purpose: commands that run the repository's own code (test
- * runners, builds, package scripts, a package manager the repository pins or
- * extends — on an untrusted repository someone else wrote that code), commands
- * a repository's own config can point at another endpoint with the user's
- * credentials (`.npmrc`, `.sentryclirc`, a Terraform or Pulumi backend), and
- * commands whose usual output is a secret.
- */
-declare const DEFAULT_PLANNER_ALLOWLIST: readonly string[];
-
 /**
  * Which interpreter runs the planner's `bash` tool, and in which language.
  *
@@ -174,6 +62,8 @@ interface ShellLaunch {
      * timeout, and stops waiting for output a moment after it exits.
      */
     wallTimeMs?: number;
+    /** A sealed run's memory limit, which its result names if the run was ended at it (ADR-0036 S1). */
+    memoryBytes?: number;
 }
 interface ResearchShellDeps {
     platform?: NodeJS.Platform;
@@ -708,6 +598,12 @@ interface IConfig {
     approvalDefaults: boolean;
     /** The user's effect allowlist rules (ADR-0035, `effectAllowlist.ts`), read on every request. It has no defaults. */
     effectAllowlist: string[];
+    /**
+     * The user's notify command as an argument vector (ADR-0053), read as each
+     * new escalation appears; empty when there is none. A repository never sets
+     * it, because it would then run a command on the user's machine.
+     */
+    notifyCommand: string[];
     /** How many fetches and searches one planner turn may make (ADR-0027). User-only, like the approval settings. */
     webReadBudget: number;
     /**
@@ -728,6 +624,17 @@ interface IConfig {
 }
 declare function enabledRunners(cfg: IConfig): RunnerId[];
 
+type NotificationAction = {
+    label: string;
+    value: string;
+};
+interface INotification {
+    info(msg: string): void;
+    warn(msg: string): void;
+    error(msg: string): void;
+    confirm(msg: string, options: string[]): Promise<string | undefined>;
+}
+
 interface ToolOutcome {
     success: boolean;
     output: string;
@@ -738,6 +645,12 @@ interface ToolOutcome {
      * names the limit it ran out of rather than blaming the command.
      */
     timedOut?: boolean;
+    /**
+     * The signal that ended the child, if one did. The adapters report it, and a
+     * sealed run's result reads it for the one that means its memory limit ended
+     * the run (ADR-0036 S1).
+     */
+    signal?: NodeJS.Signals;
 }
 interface ReadFileOpts {
     maxBytes?: number;
@@ -864,15 +777,18 @@ interface IFileSystem {
     setOutboundSecrets?(secrets: () => Iterable<string>): void;
     /** Where the filesystem tells the session, once, that the planner's shell runs without an OS sandbox here (ADR-0011 B5). */
     setNotice?(notice: (message: string) => void): void;
-    /** The session ended: its scratch directory is removed, and the next command starts a fresh one (ADR-0011 B2). */
+    /** The session ended: its scratch directories are removed, and the next command starts fresh ones (ADR-0011 B2). */
     endSession?(): void;
     /** Whether a command can run sealed on this host (ADR-0036 S6); where it cannot, the session's one notice says so. */
     canSeal?(): Promise<boolean>;
+    /** The same adapter at another workspace: what a child's planner reads, its code root being a task's worktree (ADR-0055 D5). */
+    rootedAt?(workspace: string): IFileSystem;
     /** A read-only task's shell at `site`, held to this session's allowlist and never asking (ADR-0046). */
     taskShell?(site: TaskShellSite): TaskShell;
 }
 
-declare const taskCompleteInput: z.ZodObject<{
+/** A subplanner's report (ADR-0057 R2): it passes a finding up only by reference, so nothing is reworded on the way, and only its token takes these. */
+declare const subplannerCompleteInput: z.ZodObject<{
     status: z.ZodEnum<{
         failed: "failed";
         done: "done";
@@ -927,6 +843,8 @@ declare const taskCompleteInput: z.ZodObject<{
         url: z.ZodString;
     }, z.core.$strip>]>>>;
     report: z.ZodOptional<z.ZodString>;
+    promote: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    open: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 declare const checkpointInput: z.ZodObject<{
     question: z.ZodString;
@@ -956,6 +874,24 @@ declare const readTaskInput: z.ZodObject<{
     attempt: z.ZodOptional<z.ZodNumber>;
     include_report: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
+declare const plannerPostInput: z.ZodObject<{
+    type: z.ZodEnum<{
+        attempt: "attempt";
+        finding: "finding";
+        pin: "pin";
+        decision: "decision";
+        claim: "claim";
+        artifact: "artifact";
+        contract: "contract";
+        assume: "assume";
+        scope_change: "scope_change";
+    }>;
+    title: z.ZodString;
+    key: z.ZodOptional<z.ZodString>;
+    value: z.ZodOptional<z.ZodString>;
+    detail: z.ZodOptional<z.ZodString>;
+    files: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
 declare const savePatchInput: z.ZodObject<{}, z.core.$strip>;
 declare const applyPatchInput: z.ZodObject<{
     task: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
@@ -1131,17 +1067,10 @@ declare const answerApprovalInput: z.ZodObject<{
     answer: z.ZodString;
     note: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-declare const answerCheckpointInput: z.ZodObject<{
-    task: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
-    answer: z.ZodEnum<{
-        approve: "approve";
-        reject: "reject";
-    }>;
-    reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-type TaskCompleteArgs = z.infer<typeof taskCompleteInput>;
+type TaskCompleteArgs = z.infer<typeof subplannerCompleteInput>;
 type CheckpointArgs = z.infer<typeof checkpointInput>;
 type ReadTaskArgs = z.infer<typeof readTaskInput>;
+type PostArgs = z.infer<typeof plannerPostInput>;
 type SavePatchArgs = z.infer<typeof savePatchInput>;
 type ApplyPatchArgs = z.infer<typeof applyPatchInput>;
 type ListRunnersArgs = z.infer<typeof listRunnersInput>;
@@ -1162,7 +1091,7 @@ type RetryTaskArgs = z.infer<typeof retryTaskInput>;
 type MessageTaskArgs = z.infer<typeof messageTaskInput>;
 type SkipTaskArgs = z.infer<typeof skipTaskInput>;
 type AnswerApprovalArgs = z.infer<typeof answerApprovalInput>;
-type AnswerCheckpointArgs = z.infer<typeof answerCheckpointInput>;
+type AnswerCheckpointArgs = z.infer<typeof delegatingAnswerCheckpointInput>;
 type RunScriptArgs = z.infer<typeof runScriptInput>;
 /** What a handler answers with. `isError` marks a refusal the caller should act on. */
 interface McpToolReply {
@@ -1176,6 +1105,7 @@ interface McpToolReply {
  */
 type CheckpointAnswer = {
     kind: 'continue';
+    note?: string;
 } | {
     kind: 'rejected';
     reason: string;
@@ -1193,6 +1123,8 @@ interface TaskToolHandler {
     checkpoint?: Run<CheckpointArgs>;
     /** A handoff the task may read (ADR-0047), from its attempt's log. */
     readTask?: Run<ReadTaskArgs>;
+    /** An entry on its plan's board (ADR-0057 R8); only a token with a board lists `post`. */
+    post?: Run<PostArgs>;
     /** A read-only task's shell (ADR-0046); only its token lists `run_command`. */
     runCommand?: Run<TaskRunCommandArgs>;
     /** A read-only task's prototype kept as a patch (ADR-0050); only its token lists `save_patch`. */
@@ -1204,6 +1136,10 @@ interface TaskToolHandler {
     webSearch?: Run<WebSearchArgs>;
 }
 interface PlannerToolHandler {
+    /** A handoff below this plan by reference (ADR-0057 R11); only a planner that may hold delegated tasks lists `read`. */
+    readTask?: Run<ReadTaskArgs>;
+    /** An entry on this node's board (ADR-0057 R8); a planner lists it where `read` is. */
+    post?: Run<PostArgs>;
     loadSkill?: Run<LoadSkillArgs>;
     runCommand?: Run<RunCommandArgs>;
     fetch?: Run<FetchArgs>;
@@ -1226,6 +1162,9 @@ interface PlannerToolHandler {
     answerCheckpoint?: Run<AnswerCheckpointArgs>;
     mergeAll?: Run<RunPlanArgs>;
     runScript?: Run<RunScriptArgs>;
+    /** A subplanner's end and its questions, handled by the parent's attempt (ADR-0055 D5); only its token lists them. */
+    taskComplete?: Run<TaskCompleteArgs>;
+    checkpoint?: Run<CheckpointArgs>;
 }
 interface McpTool<H> {
     name: string;
@@ -1237,9 +1176,23 @@ interface McpTool<H> {
     annotations?: {
         readOnlyHint: boolean;
     };
+    /** An older name a call may still use: it is in no list, so it costs nothing and breaks no prompt cache (ADR-0057 R11). */
+    alias?: string;
     /** Validate `args` and hand them to the handler's method for this tool. */
     call(handler: H, args: unknown, context: McpToolContext): Promise<McpToolReply>;
 }
+/** A tool set as `tools/list` answers with it: what a runner is sent, and pays for. */
+declare function toolListing<H>(tools: readonly McpTool<H>[]): {
+    annotations?: {
+        readOnlyHint: boolean;
+    } | undefined;
+    name: string;
+    description: string;
+    inputSchema: {
+        [key: string]: unknown;
+        type: "object";
+    };
+}[];
 /** The task tool whose call settles the attempt (ADR-0022, V1). */
 declare const TASK_COMPLETE_TOOL = "task_complete";
 /**
@@ -1266,6 +1219,11 @@ declare const TASK_TOOLS: readonly McpTool<TaskToolHandler>[];
  * plan's branches.
  */
 declare const READ_ONLY_TASK_TOOLS: readonly McpTool<TaskToolHandler>[];
+/** What a task's token serves (ADR-0057 R11): the flat list itself where it has no board, so a flat run's does not move by a byte. */
+declare function taskToolSet({ readOnly, board }: {
+    readOnly?: boolean;
+    board?: boolean;
+}): readonly McpTool<TaskToolHandler>[];
 /**
  * The planner's execution tools (ADR-0029, #91): each call goes to the
  * session's command seam, which checks it, asks the user where consent needs
@@ -1273,6 +1231,25 @@ declare const READ_ONLY_TASK_TOOLS: readonly McpTool<TaskToolHandler>[];
  */
 declare const PLANNER_EXECUTION_TOOLS: readonly McpTool<PlannerToolHandler>[];
 declare const PLANNER_TOOLS: readonly McpTool<PlannerToolHandler>[];
+declare const delegatingAnswerCheckpointInput: z.ZodObject<{
+    task: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    answer: z.ZodEnum<{
+        approve: "approve";
+        reject: "reject";
+    }>;
+    reason: z.ZodOptional<z.ZodString>;
+    raiseTokens: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * What a planner's token serves (ADR-0056 M6): the list as a flat planner has
+ * it unless delegation reaches it, so a flat session's tools do not change by
+ * a byte (ADR-0055 D21). A subplanner ends and asks with the tools a runner
+ * does (D4), read-only by the hint since they change no file of the workspace.
+ */
+declare function plannerToolSet({ delegates, subplanner }?: {
+    delegates?: boolean;
+    subplanner?: boolean;
+}): readonly McpTool<PlannerToolHandler>[];
 
 /**
  * The Ordewell MCP server (ADR-0022): one loopback listener per process,
@@ -1291,6 +1268,8 @@ interface TaskTokenScope {
     attempt: number;
     /** A read-only task's attempt (ADR-0046): its token lists `run_command`, `fetch` and `web_search` too, and no other task's does. */
     readOnly?: boolean;
+    /** Its plan has a board (ADR-0057 R8): its token lists `post`, and a flat task's does not. */
+    board?: boolean;
 }
 interface PlannerTokenScope {
     sessionId: string;
@@ -1300,6 +1279,10 @@ interface PlannerTokenScope {
      * model would otherwise pick over its own.
      */
     hidden?: readonly string[];
+    /** Its `submit_plan` takes a delegated task (ADR-0055 D1): a flat planner's list does not change. */
+    delegates?: boolean;
+    /** A subplanner's token (ADR-0055 D5): it serves `task_complete` and `checkpoint` too, which its handler sends to the parent's attempt. */
+    subplanner?: boolean;
 }
 /** Where a runner reaches the server and what it presents there. Never put either half in a prompt. */
 interface McpCredential {
@@ -1307,6 +1290,8 @@ interface McpCredential {
     token: string;
     /** The planner tools the token hides ({@link PlannerTokenScope.hidden}), so the runner is told of and pre-allows only what it is served. */
     hidden?: readonly string[];
+    /** Tools it serves past a flat role's, by their names on the server: a subplanner's (ADR-0055 D5), `read` where it may delegate, and `post` where it has a board (ADR-0057 R11). */
+    extraTools?: readonly string[];
     /** The token serves a read-only task's tools ({@link TaskTokenScope.readOnly}), so the runner is told of and pre-allows `run_command`, `fetch` and `web_search`. */
     readOnly?: true;
 }
@@ -1361,6 +1346,8 @@ interface McpClientConfig {
     headers: Record<string, string>;
     /** Planner tools the token hides: a runner must neither pre-allow nor mention them. */
     hidden?: readonly string[];
+    /** Tools served past a planner's: a subplanner's, to pre-allow with the rest (ADR-0055 D5). */
+    extraTools?: readonly string[];
     /** A read-only task's token (ADR-0046): `run_command`, `fetch` and `web_search` are among its tools, for the runner to pre-allow and name. */
     readOnly?: true;
 }
@@ -1533,18 +1520,26 @@ interface SandboxProfile {
     limits?: SandboxLimits;
 }
 /**
- * Held by the kernel's resource limits, set before the launcher starts, and
- * by the caller's clock (ADR-0036 S1).
+ * Held by the kernel's resource limits, set before the launcher starts, by a
+ * watcher beside the launcher, outside the sandbox, and by the caller's clock
+ * (ADR-0036 S1).
  */
 interface SandboxLimits {
     /** Processes the command may start beyond those its user already runs, which the kernel's limit counts too. */
     processes: number;
     /**
-     * Bytes of address space any one of its processes may map. On macOS, where
-     * every program maps hundreds of gigabytes as it starts, it is counted on
-     * top of that.
+     * Bytes of real memory the command may hold: resident memory summed across
+     * its processes, which the watcher reads about once a second and ends the
+     * command for passing ({@link MEMORY_LIMIT_SIGNAL}).
      */
     memoryBytes: number;
+    /**
+     * Bytes of address space any one of its processes may map: a backstop
+     * against a runaway allocator, not a measure of memory, since V8 reserves
+     * far more than it touches. On macOS, where every program maps hundreds of
+     * gigabytes as it starts, it is counted on top of that.
+     */
+    addressSpaceBytes: number;
     /** Milliseconds before the caller kills the command, and with it every process it started. */
     wallTimeMs: number;
 }
@@ -1559,9 +1554,12 @@ interface SandboxInvocation {
 interface SandboxLaunch {
     file: string;
     args: string[];
+    /** What `file` starts with. A launcher that runs before the sandbox gets only what the profile keeps of the host's. */
     env: NodeJS.ProcessEnv;
     /** The profile's wall-time limit: the caller kills the launch with SIGKILL once it has run this long. */
     wallTimeMs?: number;
+    /** The profile's memory limit, past which the launch ends by {@link MEMORY_LIMIT_SIGNAL}. */
+    memoryBytes?: number;
 }
 type SandboxProbe = {
     ok: true;
@@ -1676,7 +1674,12 @@ interface PlannerSandboxDeps {
     uid?: number;
     exec?: ProbeExec;
 }
-/** Enough for a loop over a repository's files, a pipeline or a short script; not for a build. */
+/**
+ * Time enough for a loop over a repository's files, a pipeline or a short
+ * script, not for a build. The memory is real memory across the run; the
+ * address space is per process and far above what V8 reserves for ordinary
+ * programs (ADR-0036 S1, which records the measurement).
+ */
 declare const SEALED_LIMITS: SandboxLimits;
 /**
  * A read-only task's sealed runs (ADR-0046): the same resources, with the ten
@@ -1699,18 +1702,18 @@ interface PlannerShellLaunch {
     sandboxed: boolean;
 }
 /**
- * One session's view of the sandbox: its scratch directory, made on the first
- * command and removed when the session ends, and its one notice when the
- * sandbox, or a sealed run in it, cannot run here.
+ * One session's view of the sandbox: a scratch directory for each profile,
+ * made on its first command and removed when the session ends, and its one
+ * notice when the sandbox, or a sealed run in it, cannot run here.
  */
 declare class PlannerShellSandbox {
     private readonly resolve;
-    private scratch;
+    private readonly scratch;
     private noticed;
     private notice;
     constructor(resolve?: () => Promise<PlannerSandboxAvailability>);
     setNotice(notice: (message: string) => void): void;
-    /** The same host's sandbox for another caller, with a scratch directory of its own: a read-only task's (ADR-0046). */
+    /** The same host's sandbox for another caller, with scratch directories of its own: a read-only task's (ADR-0046). */
     withOwnScratch(): PlannerShellSandbox;
     /**
      * The launch for one command (B6): the research shell wrapped in the
@@ -1733,8 +1736,10 @@ declare class PlannerShellSandbox {
     /**
      * The launch for a harness's own shell (ADR-0036 N2): the same sealed profile
      * as a sealed run, with the network the harness gives it (N3), plus the
-     * harness's short temporary directory. The workspace stays read-only. Throws
-     * where the sandbox cannot run, so a caller never falls back to the bare shell.
+     * harness's short temporary directory. The workspace stays read-only. Its
+     * home is a scratch directory of its own, so whatever startup files its shell
+     * reads, a sealed run wrote none of them (S8). Throws where the sandbox
+     * cannot run, so a caller never falls back to the bare shell.
      */
     launchNativeShell(opts: {
         workspace: string;
@@ -1743,9 +1748,9 @@ declare class PlannerShellSandbox {
         shellArgs?: readonly string[];
         env?: NodeJS.ProcessEnv;
     }): Promise<SandboxLaunch>;
-    /** The scratch directory every launch here gets as `$TMPDIR` and `$HOME`, made if it is not there. */
+    /** The scratch directory a sealed run gets as `$TMPDIR` and `$HOME`, made if it is not there. */
     scratchPath(): string;
-    /** The session ended: its scratch directory goes, and a next session starts with a fresh one and its own notice. */
+    /** The session ended: its scratch directories go, and a next session starts with fresh ones and its own notice. */
     end(): void;
     private say;
     private invocation;
@@ -1755,6 +1760,689 @@ declare class PlannerShellSandbox {
 /** A runner's report on the Ordewell server's connection, in one vocabulary for every runner. */
 type AttachState = 'connected' | 'pending' | 'failed';
 
+interface SessionMeta {
+    id: string;
+    goal: string;
+    runners: RunnerId[];
+    taskCount: number;
+    status: PlanStatus;
+    createdAt: string;
+    updatedAt: string;
+}
+interface SessionData {
+    meta: SessionMeta;
+    /** The full plan state — including conversationHistory, prdMarkdown, and queuedMessages. */
+    plan: LegacyPlanState;
+}
+
+interface ILogger {
+    warn(scope: string, message: string, err?: unknown): void;
+}
+declare class ConsoleLogger implements ILogger {
+    warn(scope: string, message: string, err?: unknown): void;
+}
+declare const defaultLogger: ILogger;
+
+/**
+ * A path segment for an id that came from outside — a session id from a URL,
+ * a task id a planner wrote. A plain id is used as is; anything that could
+ * climb out of its directory, or is not portable as a file name, is hex-encoded.
+ */
+declare function idSegment(id: string): string;
+/**
+ * The directory beside a session's file for what it keeps outside that file —
+ * its task logs (ADR-0018, P1). It goes when the session does. A child's sits
+ * under its root's at every depth, so it goes with its root and no prune or
+ * sweep of a worktree reaches it (ADR-0055 D11).
+ */
+declare function sessionDataDir(sessionId: string, baseDir?: string, rootSessionId?: string): string;
+/** Where a child session's state lives. `baseDir` is the state root: the root Session's workspace, never a worktree. */
+interface ChildSessionPlace {
+    baseDir: string;
+    rootSessionId: string;
+    sessionId: string;
+}
+declare function saveSession(plan: LegacyPlanState, goal: string, baseDir?: string, id?: string): SessionMeta;
+/** Saved beside the child's logs, in the root's directory; `listSessions` never sees it (ADR-0055 D11). */
+declare function saveChildSession(plan: LegacyPlanState, goal: string, place: ChildSessionPlace): SessionMeta;
+/** The ids of every child saved under a root, at any depth. */
+declare function listChildSessions(rootSessionId: string, baseDir?: string): string[];
+declare function listSessions(baseDir?: string, logger?: ILogger): SessionMeta[];
+/** A child is read only through its root, and only when asked for (ADR-0055 D17). */
+declare function loadChildSession(place: ChildSessionPlace, logger?: ILogger): {
+    meta: SessionMeta;
+    plan: LegacyPlanState;
+} | null;
+declare function loadSession(sessionId: string, baseDir?: string, logger?: ILogger): {
+    meta: SessionMeta;
+    plan: LegacyPlanState;
+} | null;
+declare function loadSessionPlanState(sessionId: string, baseDir?: string, logger?: ILogger): {
+    meta: SessionMeta;
+    plan: PlanState;
+} | null;
+declare function getLatestSession(baseDir?: string, logger?: ILogger): {
+    meta: SessionMeta;
+    plan: LegacyPlanState;
+} | null;
+declare function deleteSession(sessionId: string, baseDir?: string, logger?: ILogger): boolean;
+
+/**
+ * Task skills end to end (ADR-0024): a skill reaches a runner only by being
+ * attached to its task in the plan, and Ordewell puts its body in the task's
+ * prompt — so it works the same on every runner, and nothing is written to a
+ * harness's own skills directory.
+ */
+/** Where a task's skill names are looked up: global first, then the workspace folders it reads. */
+interface SkillLookup extends Pick<SkillsService, 'findSkill' | 'searchedDirs'> {
+    /**
+     * Set when tasks get worktrees: of `skills`, the workspace ones git will not
+     * carry into them, each SKILL.md path mapped to the folder to commit,
+     * relative to the workspace root.
+     */
+    uncommitted?(skills: readonly SkillInfo[]): Promise<Map<string, string>>;
+}
+/**
+ * Where a workspace's skills are read, known without asking git: the repos
+ * of its group in layout order (`['.']` for one repository), and whether
+ * tasks will get worktrees, which only a committed skill reaches.
+ */
+interface SkillLayout {
+    repos: readonly string[];
+    worktrees: boolean;
+}
+
+/**
+ * Where the run's tasks will work: `false` in the shared workspace root;
+ * otherwise each in its own worktree of every repo of the group (ADR-0013,
+ * ADR-0014), which is what decides if tasks on the same file must be ordered.
+ */
+type IsolatedExecution = false | RepoGroupLayout;
+interface PlannerModes {
+    autonomousDefault: boolean;
+    /** Not a toggle: a fact about the run. */
+    isolatedExecution: IsolatedExecution;
+    /**
+     * Where the run's tasks will look their skills up (ADR-0024), also a fact
+     * about the run. A plan attaching a planner skill is refused against it,
+     * and a coding agent's submit_plan call is refused in its turn rather than
+     * accepted and then failed. Absent: the plan is not checked.
+     */
+    taskSkills?: SkillLookup;
+}
+
+type IsolationNoticeLevel = 'info' | 'warn' | 'error';
+/**
+ * How an attempt that may run in a worktree gets one: fresh, the kept one for
+ * a repair, restoring the previous attempt's work, or fresh and thrown away
+ * whatever it changes, for a read-only task (ADR-0046).
+ */
+type AttemptIntent = 'fresh' | 'repair' | 'readOnly' | PrepareIntent;
+/**
+ * What adopting a persisted run found: nothing to change, landed work git
+ * shows the user has merged since, or a settled run that had nothing left to
+ * hand over and was cleared up.
+ */
+type AdoptOutcome = 'unchanged' | 'changed' | 'cleared';
+interface AttemptWorkspace {
+    cwd: string;
+    worktree: boolean;
+    /** The task workspace holding the attempt's worktrees, which `cwd` is in; set with `worktree` when it was prepared. */
+    workspace?: string;
+    /** Set for a `restore` in a worktree; absent in the checkout, where the previous attempt's edits remain. */
+    previousWork?: PreviousWork;
+}
+/**
+ * What the controller reports. It never schedules or emits on its own: the
+ * orchestrator turns these into observer events and decides what runs next.
+ */
+interface IsolationRunListener {
+    /**
+     * The run record changed and should be persisted with the plan. `detached`
+     * is set instead when the record that changed is no longer the plan's own —
+     * a release that outlived the plan load that replaced its run — and belongs
+     * to the session that was left.
+     */
+    changed(detached?: IsolationRun): void;
+    /** A run did not start: `repos` of the group have tracked changes. */
+    blocked(repos: string[]): void;
+    /** An isolated run closed and handed its integration branches over. */
+    handoff(handoff: IsolationHandoff): void;
+    /** The run was cleared up and forgotten: nothing was handed over, or it was discarded. */
+    closed(): void;
+    /** The run is over, discarded or cleared up, whether or not its record stays: nothing it carried goes on (ADR-0045 L5). A Merge all it goes on after is not this. */
+    ended(): void;
+    /** Already said through the notifications; also for a surface that shows no toasts. */
+    notice(level: IsolationNoticeLevel, message: string): void;
+    /** A clean-up took the branches these resolver tasks would merge, and their links with them. */
+    resolversEnded(resolverIds: readonly string[]): void;
+}
+interface IsolationRunControllerDeps {
+    isolation: IWorktreeIsolation;
+    config: IConfig;
+    notifications: INotification;
+    workspaceRoot: () => string;
+    /** A child session's state root, which every run it mints keeps (ADR-0055 D11); absent on a flat run. */
+    stateRoot?: string;
+    listener: IsolationRunListener;
+    /**
+     * The tasks no clean-up of the whole run may take a worktree from: an
+     * attempt is running them, or the plan has them in progress or waiting on
+     * the user mid-attempt.
+     */
+    liveTasks: () => ReadonlySet<string>;
+    /** What a task depends on now, directly or not, read as it lands: the plan may let go of that later, and a revert may not (ADR-0054). */
+    landedOn: (taskId: string) => readonly string[];
+}
+/**
+ * The lifecycle of a plan's isolation run (ADR-0013, ADR-0014, ADR-0020),
+ * between the scheduler and the git layer: deciding, at a run's first change
+ * task, whether it executes in worktrees, a blocked run and how it goes on,
+ * each attempt's working directory, releasing worktrees, which landed work the
+ * user has merged, the tree check of an ops task, the handoff when the run
+ * closes, and what the user does with it afterwards. The record it keeps
+ * outlives one run — a resumed plan continues it.
+ */
+declare class IsolationRunController {
+    private readonly isolation;
+    private readonly config;
+    private readonly notifications;
+    private readonly workspaceRoot;
+    private readonly stateRoot;
+    private readonly listener;
+    private readonly liveTasks;
+    private readonly landedOn;
+    private run;
+    /** See {@link mergedRun}. */
+    private merged;
+    /** An adoption stays scoped even while cleanup temporarily leaves no run record. */
+    private adoptions;
+    /** Copied paths already reported for the current run: every task gets the same copies. */
+    private reportedCopies;
+    private gitShortfallSaid;
+    private reportedSetupFailures;
+    /**
+     * How the open run executes; null while no run is open, `undecided` until
+     * its first change task asks. A run is one Execute-Plan or one manual task
+     * run, from its start until it settles or is stopped.
+     */
+    private mode;
+    /** Resolver task id → the conflicted task it resolves; see {@link linkResolver}. */
+    private resolvers;
+    private opening;
+    private opened;
+    /** Bumped by an interrupt, so an activation in flight across it does not open the run it ended. */
+    private activations;
+    /** The start a dirty tree turned away, handed back once the user chooses how to go on. */
+    private blockedStart;
+    /** How many starts it has turned away; a replay can be turned away again in the same run. */
+    private turnedAway;
+    /** The dirty repos behind {@link blockedStart}, for the stash notice. */
+    private blockedRepos;
+    constructor(deps: IsolationRunControllerDeps);
+    /** The plan's run record, open or not; null when the plan has not isolated. */
+    get current(): IsolationRun | null;
+    /** What a child works through: this run's own, so a tree takes one admin lock (ADR-0055 D11). */
+    get childIsolation(): IWorktreeIsolation;
+    /**
+     * The id of the plan's last isolated run once it closed with everything it
+     * landed merged into the user's branch and was cleared up: what tells a
+     * Merge all asked for after it, which has nothing to merge, from one in a
+     * plan that never isolated (ADR-0029). Null while the plan holds a run
+     * record, and once a later run decides how it executes. Saved with the plan.
+     */
+    get mergedRun(): string | null;
+    get isOpen(): boolean;
+    /** How many runs have opened: what tells one run's launches from the next one's. */
+    get epoch(): number;
+    /** The open run has decided whether it isolates. */
+    get decided(): boolean;
+    /** The open run executes in worktrees. */
+    get isolating(): boolean;
+    /** A run is waiting on the user to stash or to go on without isolation. */
+    get blocked(): boolean;
+    /** How many starts a dirty tree has turned away: what tells one wait on it from the next (ADR-0053). */
+    get blockedStarts(): number;
+    /** What the plan persists of isolated execution; null when no run ever isolated. */
+    get planIsolation(): PlanIsolation | null;
+    /** The one guard of every action on the run: a plan that never isolated is a request refused, not a fault. */
+    requireRun(): IsolationRun;
+    /** A task's record in the open run, only while that run isolates. */
+    openRecord(taskId: string): IsolationTaskRecord | undefined;
+    /** Where a task's isolated work stands; null when the plan has no isolation run to speak of. */
+    taskIsolation(taskId: string): TaskIsolation | null;
+    view(): IsolationView | null;
+    /**
+     * Take over a plan's persisted isolation, or none for a plan that has not
+     * isolated yet. Whatever a crashed process left behind for the run — a
+     * worktree still marked active, a directory no record owns — is pruned,
+     * while kept, failed and conflicted worktrees stay for the user. Then git is
+     * asked which landed work the user has merged since the record was saved:
+     * a settled run whose landed work is all in HEAD has nothing left to hand
+     * over, so it is cleared up as Merge all would have, unless it still holds
+     * work that never landed (ADR-0013).
+     *
+     * Deliberately not reported to the listener: adopting is not a change of the
+     * session's own, and a host that adopts without persisting (VS Code's
+     * restore) would otherwise write a new session file on every reload. What
+     * git changed is returned instead, for the caller to save where it can and
+     * announce. A plan loaded meanwhile supersedes this adoption, which then
+     * touches nothing and resolves `unchanged`. `mergedRun` is the plan's saved
+     * {@link mergedRun}.
+     */
+    adopt(state: PlanIsolation | null, mergedRun?: string): Promise<AdoptOutcome>;
+    /** Throws, as {@link hostChild} does, for a task with no worktree: read before a carve, so one that cannot seat a child spends nothing. */
+    requireChildSeat(taskId: string): void;
+    /**
+     * The child session a task's worktree is the code root of, named on the
+     * task's record so a reopen knows that worktree is a child's (ADR-0055 D17),
+     * and the same child again once it is. A task with no worktree has nothing
+     * to host one in: a run that shares the workspace root would root the child
+     * in the user's checkout (D12).
+     */
+    hostChild(taskId: string, mintSessionId: () => string): string;
+    /** The child session seated in a task's worktree, if one is. */
+    childSession(taskId: string): string | undefined;
+    /** A child's run goes, and what that kept or could not let go is said, as a run's own discard says it (ADR-0055 D15). */
+    discardChild(place: ChildSessionPlace): Promise<IsolationRemoval>;
+    /** Open a run if none is, leaving whether it isolates to its first change task. */
+    open(): void;
+    /**
+     * Decide once per run, as its first change task starts, whether it executes
+     * in worktrees (ADR-0020): an ops task needs none, so a run of only ops
+     * tasks never asks. `resume` is what a dirty tree parks until the user
+     * chooses how to go on. Resolves false while the run waits on that choice.
+     */
+    decide(resume: () => Promise<void>): Promise<boolean>;
+    /**
+     * Whether the run in force, or else the next one, gives each task its own
+     * worktrees, and of which repo group — what the planner is told, since it
+     * decides whether tasks on the same file have to be ordered and which shared
+     * paths two tasks must not edit at once. A tree that would block counts as
+     * not isolating: the user may yet run without isolation, and ordering is
+     * the safe rule then.
+     */
+    plannerLayout(): Promise<IsolatedExecution>;
+    /**
+     * Where the workspace's skills are read, and whether tasks get worktrees.
+     * Read synchronously inside a planner turn or a chip edit, so it comes from
+     * the files, not git or the planner's last layout: a restored session is
+     * right from its first edit. The run's repos while it isolates; otherwise
+     * the group the workspace holds, in worktrees unless isolation is off or
+     * this run chose to share the root.
+     */
+    skillLayout(): SkillLayout;
+    /**
+     * Go on with the start a dirty tree turned away. `stash` puts the user's
+     * tracked changes on the git stash first, so the run isolates; `shared` runs
+     * this one run in the workspace root, knowingly; `reread` does nothing to the
+     * tree, so the replay asks about it again (ADR-0053). Returns the parked start
+     * for the caller to replay; null when nothing was parked.
+     */
+    continueBlocked(how: 'stash' | 'shared' | 'reread'): Promise<(() => Promise<void>) | null>;
+    /**
+     * The working directory of an attempt that may run in a worktree — which
+     * attempts do is the attempt kind's to say (see `attemptKind.attemptWorkspace`):
+     * the worktree prepared for it in an isolated run, the kept one for a
+     * conflict repair, else the workspace root. `worktree` says which. Does not
+     * itself report a worktree it creates as a change — the caller does once
+     * the attempt is committed as running, so a spawn abandoned or failed after
+     * this settles is not misreported as a change that stuck.
+     */
+    attemptCwd(task: Task, intent: AttemptIntent): Promise<AttemptWorkspace>;
+    /** The workspace root, for an attempt that runs outside any worktree. */
+    workspaceCwd(task: Task): Promise<{
+        cwd: string;
+        worktree: boolean;
+    }>;
+    private reopenCwd;
+    private prepareCwd;
+    /**
+     * Land a task's work on the run's integration branches. The record is
+     * reported changed once the landing is set and before the first merge, so
+     * a crash mid-landing leaves the tips to roll back to, and again once it
+     * settles. A git error is `failed`, never a throw.
+     */
+    integrate(task: Task, commit?: HandoffCommit): Promise<IsolationOutcome>;
+    private keepLandedOn;
+    /** What a conflict repair's work shows (ADR-0015); git that cannot tell counts against it. */
+    verifyRepair(task: Task): Promise<RepairEvidence>;
+    /** What a repair brings onto the tip it was repaired against (ADR-0055 D14); throws where git cannot say, so nothing lands on a guess. */
+    repairPaths(task: Task): Promise<string[]>;
+    /**
+     * Let go of a task's worktree. `keep` leaves it and its branch for
+     * inspection; otherwise both go. A landing still in flight settles first, so
+     * the worktree is never torn down underneath its merge. Bound to the run
+     * the call was made in: a plan loaded meanwhile adopts its own run, whose
+     * records share these task ids and are not this release's to touch.
+     */
+    release(taskId: string, opts: {
+        keep: boolean;
+    }, landing?: Promise<unknown> | null): Promise<void>;
+    /**
+     * Close the open run. An isolated one hands its integration branch over for
+     * review — unless everything it landed is merged already, at merge gates or
+     * by the run's automatic Merge all, which leaves nothing to hand over, so it
+     * is cleared up as a Merge all would have.
+     */
+    close(): Promise<void>;
+    /**
+     * Whether a task's landed work still waits to be merged into the user's
+     * branch — what holds an ops or user task at its merge gate (ADR-0020). A
+     * task with no record never landed anything to wait for.
+     */
+    awaitsMerge(taskId: string): boolean;
+    /**
+     * Look again for landed work the user has merged — by Merge all, or by hand
+     * with git — or has taken back out. Resolves true when a mark changed.
+     */
+    refreshInHead(): Promise<boolean>;
+    /** Whether any landed work reads as merged: an answer git can take back, if the user takes the merge out. */
+    get readsMerged(): boolean;
+    /** Mark the run's landed work as git finds it now; true when a mark changed. */
+    private findLanded;
+    /** The run landed something and every landing is in the user's HEAD. */
+    private allMerged;
+    /**
+     * The tracked state of the workspace as an attempt whose tree is checked
+     * starts (see `attemptKind.checksTree`), for {@link filesChangedSince}
+     * (ADR-0020). Null where the check does not run: a run that shares the
+     * workspace root, where every task's edits land in it, or a workspace git
+     * cannot isolate at all.
+     */
+    snapshotWorkspace(): Promise<TreeSnapshot | null>;
+    /** Tracked files changed since `snapshot`; none when the run has since gone on in the workspace root. */
+    filesChangedSince(snapshot: TreeSnapshot | null): Promise<string[]>;
+    /**
+     * A stop or a plan load: the open run ends without a handoff and a parked
+     * start is dropped. `keepOpen` spares a run the scheduler is still driving.
+     */
+    interrupt(opts?: {
+        keepOpen?: boolean;
+    }): void;
+    /**
+     * Mark which added task resolves which conflict. The resolver merges the
+     * conflicted task's branch by hand in its own worktree; once that lands, the
+     * conflicted task can land in turn — through the same merge, so a resolver
+     * that did not really bring it along conflicts again instead of being taken
+     * at its word.
+     */
+    linkResolver(resolverId: string, conflictedId: string): void;
+    /** The conflicted task a landed resolver was added for, forgotten as it is returned. */
+    takeResolver(resolverId: string): string | undefined;
+    /** The tasks added to resolve this task's conflict: one, but for a plan saved before that was the rule (ADR-0015). */
+    resolversOf(conflictedId: string): string[];
+    /** The paths a task's branch changed since its base, by their place in the workspace. Throws where they cannot be read: a verdict that rests on them fails closed (ADR-0055 D6). */
+    changedPaths(taskId: string): Promise<string[]>;
+    /** The branch this run's work lands on, which a board's files are compared with (ADR-0057 R9). */
+    get integrationBranch(): string | undefined;
+    /** See {@link IWorktreeIsolation.blobOn}. */
+    blobOn(branch: string, file: string): Promise<string | null | undefined>;
+    taskDiff(taskId: string, options: TaskDiffRead): Promise<TaskDiffResult>;
+    reviewDiff(): Promise<string>;
+    /**
+     * "Merge all": the run's integration branches into whatever the user has
+     * checked out, in every repo or none. During a run it merges what has
+     * landed so far and the run goes on (ADR-0020): its branches stay for the
+     * tasks still to land. Once a settled run merged everything, it has nothing
+     * left to hand over, so it is cleared up and forgotten; a branch the user's
+     * HEAD somehow does not contain stays for the next run's sweep.
+     */
+    merge(): Promise<IsolationMergeResult>;
+    /** What git says of landed work a revert would take; see {@link IWorktreeIsolation.readLanded}. */
+    readLanded(taskIds: readonly string[]): Promise<LandedWork>;
+    /**
+     * Revert tasks' landings on the integration branches (ADR-0054). The record
+     * is reported changed once the tips are set and before the first commit,
+     * again as each commit is made, so a crash leaves it to tell them from
+     * anyone's, and once it settles. Bound to the run it was
+     * asked in: a plan loaded meanwhile has records of its own under these ids,
+     * and is saved without what this would write to that run's branches, so it
+     * stops the revert and leaves them as they were.
+     */
+    revert(taskIds: readonly string[], watch: Omit<RevertWatch, 'persist'>): Promise<IsolationRevertResult>;
+    /**
+     * Worktrees and task branches go; the integration branch and the record stay
+     * for review and merge. Refused while a task of the run is still live.
+     */
+    cleanup(): Promise<void>;
+    /**
+     * The run and everything it made go, and the plan forgets it; the next run
+     * starts afresh. Refused while a task of the run is still live.
+     */
+    discard(): Promise<void>;
+    /** The records of tasks still live, whose worktrees no clean-up of the whole run may take. */
+    private liveRecords;
+    private refuseWhileLive;
+    /**
+     * Clear a settled run up once everything it landed is merged — and only
+     * when nothing else is left in it: a live task, or a worktree holding work
+     * that never landed, keeps the whole run, worktrees and branches, rather
+     * than leaving that work to a deletion.
+     */
+    private clearMerged;
+    /** The records that keep a settled run from being cleared up: live, or holding work that never landed. */
+    private holdouts;
+    /** The run's worktrees and merged branches go; false, said, when git would not let them. */
+    private discardMerged;
+    /** Say what a removal kept back instead of deleting: where the work went, or which worktree stayed. */
+    private report;
+    /** The branches the links' resolvers would merge have gone: the links go, and the scheduler is told of the tasks left. */
+    private endResolvers;
+    /** The run goes from the plan; `merged` names it as {@link mergedRun} when everything it landed was merged. */
+    private forget;
+    private assess;
+    private activate;
+    private begin;
+    /** What earlier runs left merged in the group goes; a failure here is worth a word, never a stopped run. */
+    private sweep;
+    /**
+     * The plan's run carries on while it still has any record: anything landed
+     * means a resumed plan's dependents must start from a tip that holds their
+     * predecessors' work, and anything held — a kept attempt, a conflict, a
+     * repair — is work the user may still want, which a fresh run's mint would
+     * delete. Only a run with no records at all is superseded, and not one that
+     * reverted the tasks it had: a retry starts from its tip (ADR-0054). A record
+     * that names a child holds a code root, on a path that child's own run is tied
+     * to, whether or not a Stop has yet taken it off `active` (ADR-0055 D17).
+     */
+    private continuableRun;
+    /**
+     * A run with no records at all holds only superseded attempts, so it goes —
+     * but its integration branch only where the user's HEAD contains it, as does
+     * that of a run that cannot be continued for another reason (it ran from a
+     * different workspace path): only the user gives landed work up.
+     *
+     * False when `interrupted` came while git was minting: a newer activation
+     * may be minting its own run, so this one is never installed over it, and
+     * is discarded rather than left as branches no record names.
+     */
+    private mint;
+    private reportCopies;
+    private reportSetupFailures;
+    /** Said at the first isolated run, where Ordewell first leans on git and where `git-missing` is said; a child's parent has said it already. */
+    private sayGitShortfall;
+    private tell;
+}
+
+/** What a backend can be asked to prove (ADR-0059 L3). */
+type Guarantee = 'fs.hostHidden' | 'fs.writeScope' | 'net.allowlist' | 'net.noMetadata' | 'cred.unreadable' | 'kernel.separate' | 'limits.memory';
+/** What a probe found: how, and when. Never declared, so an unproven entry relaxes nothing (L3). */
+interface GuaranteeProof {
+    proven: boolean;
+    by: string;
+    at: string;
+}
+type GuaranteeReport = Record<Guarantee, GuaranteeProof>;
+/**
+ * Who asks, and in what role, which is policy input: a role is resolved to a
+ * {@link LeaseSpec} before a backend sees one. `child-plan` reserves a node
+ * and no slot (ADR-0055 D18). So does `merge`: it starts no session, and it
+ * reaches a checkout, so a backend hears of it.
+ */
+interface LeaseRequest {
+    node: {
+        sessionId: string;
+        taskId?: string;
+    };
+    role: 'planner' | 'task' | 'script' | 'child-plan' | 'merge';
+    runner?: RunnerId;
+}
+/** Where a lease puts its session. */
+type LeaseWorkspace = {
+    kind: 'checkout';
+} | {
+    kind: 'worktree';
+    intent: AttemptIntent;
+};
+interface LeaseSpec {
+    /** The attempt's task, as the claim read it; a planner's lease has none. */
+    task?: Task;
+    workspace: LeaseWorkspace;
+    /** Open fails if one of these cannot be proven. */
+    required: readonly Guarantee[];
+}
+/** A runner's session, which is what a Continue resumes: the id on the host today, and more behind a container (L2). */
+interface LeaseSessionState {
+    runner: string;
+    nativeSessionId: string | null;
+}
+/**
+ * What outlives a lease (L2): a branch is not the whole result. A synchronous
+ * read: the attempt that ends saves the session before anything can read it.
+ */
+interface LeaseResult {
+    /** Each repo's branch, by repo path; empty for work with no worktree. */
+    refs: Record<string, string>;
+    sessionState: LeaseSessionState;
+}
+/** How a lease's session ended where the host could not watch it (L3); `expired` comes with the first backend that has a time limit. */
+type LeaseExit = 'oom' | 'killed';
+/** A runner's launch, as its adapter wrote it for this host. */
+interface RunnerLaunch {
+    command: string;
+    args: readonly string[];
+    env: Readonly<Record<string, string>>;
+    /** Paths on this host, named in `args`, that the process reads, the one holding its token among them. */
+    files: readonly string[];
+}
+/** What this host launches instead. */
+interface PlacedLaunch {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+    /** End the process where it runs: killing what this host launched does not reach it. */
+    stop(): void;
+    /** The process has ended. */
+    ended(): void;
+}
+/**
+ * Where a lease that does not run its session on this host puts its runner. A
+ * runner is still handed a cwd and nothing more (ADR-0013): only {@link RunnerProcess}
+ * reads this, and an adapter writes the launch it always wrote.
+ */
+interface RunnerPlacement {
+    place(launch: RunnerLaunch): Promise<PlacedLaunch>;
+    /** Make a listener on this host's loopback reachable from there, and answer the URL to reach it by (`endpoints.mcp`). */
+    reach(url: string): Promise<string>;
+    /** The blob a file holds there, as git would name it, read where the attempt's work is; undefined for what cannot be read. */
+    blob(file: string): Promise<string | undefined>;
+}
+/** One repository of an attempt's worktree, for a backend that keeps a copy of it elsewhere. */
+interface LeaseRepo {
+    /** Relative to the workspace; `.` for a lone repository. */
+    path: string;
+    /** The repository on this host. */
+    root: string;
+    /** Its worktree for this task. */
+    worktree: string;
+    branch: string;
+    integrationBranch: string;
+    /** What Ordewell linked into the worktree, which is no attempt's work. */
+    linked: readonly string[];
+}
+interface OpenLease {
+    workspace: {
+        cwd: string;
+        /** The task workspace holding its worktrees, when it has any. */
+        writable?: string;
+        /** Whether it runs in a worktree prepared for it rather than at the root. */
+        worktree: boolean;
+        /** What became of the previous attempt's work, where a restore was asked for. */
+        previousWork?: PreviousWork;
+        /** Each repository of its worktree, plural as a repo group's are (ADR-0014). */
+        repos?: readonly LeaseRepo[];
+    };
+    guarantees: GuaranteeReport;
+    exportResult(session: LeaseSessionState): LeaseResult;
+    /** Set where the runner does not run on this host. */
+    placement?: RunnerPlacement;
+    /** How its session ended, once it has, where the backend can tell (L3). */
+    ended?(): Promise<LeaseExit | null>;
+}
+/**
+ * Taken in the claim's synchronous step (L1). What it reserves is given back at
+ * {@link release}; the workspace it opened need not go with it: a worktree
+ * outlives the lease that made it, for a repair or a continue, so what becomes
+ * of it is {@link ExecutionBackend.letGo}.
+ */
+interface ReservedLease {
+    readonly id: string;
+    /** Whether this lease holds a slot: a delegated task's and a merge's do not. */
+    readonly holdsSlot: boolean;
+    /** Runs after the claim, where the workspace is made. Rejects without making one once `signal` has aborted. */
+    open(spec: LeaseSpec, signal: AbortSignal): Promise<OpenLease>;
+    /** Idempotent and synchronous: an attempt's end frees its slot before anything awaits (ADR-0029). */
+    release(reason: string): void;
+}
+/** One task's workspace, as a restart finds it. */
+interface LeaseRecord {
+    taskId: string;
+    status: string;
+    worktrees: readonly string[];
+}
+interface ExecutionBackend {
+    /** What it can prove now. */
+    probe(): Promise<GuaranteeReport>;
+    /** Why this may not be reserved now, or null. Synchronous, and changes nothing: it is also asked with no claim to follow. */
+    refusal(request: LeaseRequest): string | null;
+    /** Synchronous, inside the claim. A refusal keeps the Session that asked, for what frees next. */
+    reserve(request: LeaseRequest): {
+        lease: ReservedLease;
+    } | {
+        refused: string;
+    };
+    /** What becomes of a task's workspace, with no lease needed: a kept worktree outlives the one that opened it. */
+    letGo(taskId: string, how: {
+        keep: boolean;
+        landing?: Promise<unknown> | null;
+        reason: string;
+    }): Promise<void>;
+    /** What a restart finds. Starts nothing (ADR-0044). */
+    list(): Promise<readonly LeaseRecord[]>;
+    /**
+     * Bring a task's work to its worktree, for a backend that keeps it elsewhere:
+     * the half of a result that takes time and can be refused (L2). By task, since
+     * a landing can come after its attempt, as a Mark complete does. Absent, the
+     * work is there already. Rejects with why it must not land.
+     */
+    collect?(taskId: string): Promise<void>;
+    /**
+     * Everything it has running has gone and what was on its way has arrived, as
+     * the Session around it closes. Absent, nothing outlives an attempt's runner.
+     * What a next attempt comes back to stays, and it never rejects.
+     */
+    settle?(): Promise<void>;
+    /** The workspace root's repositories, where a run knows them: a repo group's root is no repository to ask. */
+    checkoutRepos?(): readonly LeaseRepo[];
+    /**
+     * Let go of what its tree left where only it can reach, as a Clean up gives the
+     * run up. Absent, there is nothing but the worktrees. Reports what it could not
+     * clear, and never rejects: it is no reason for a clean-up to fail.
+     */
+    reclaim?(): Promise<void>;
+}
+
 /**
  * The harness-planner transport contract (ADR-0009).
  *
@@ -2058,6 +2746,10 @@ interface PlannerStartOptions extends AgentStartCommon {
      * these are the only ones it gets, and each is handed over as parsed.
      */
     projectServers?: ProjectMcpServer[];
+    /** The harness's own subagents are off for this session (ADR-0056 M6), each runner by its own switch. Absent means as the harness has them. */
+    noSubagents?: true;
+    /** What a subplanner's process loads of the user's setup (ADR-0057 R11); absent means `user`. */
+    runnerConfig?: TaskRunnerConfig;
 }
 /**
  * What a runner manifest says the task's mode and effort mean (ADR-0001),
@@ -2074,6 +2766,14 @@ interface TaskRunnerFlags {
     /** The manifest's further settings for the task's mode, by setting name — see `RunnerFeatures.modeSettings`. */
     modeSettings: Record<string, string>;
 }
+/**
+ * What a task runner loads of the user's own setup (the `taskRunnerConfig`
+ * setting): `user` is everything the runner would load for the user,
+ * `minimal` only what a task needs — Ordewell's server, the repository's
+ * instructions — so the user's connectors, skills and settings do not ride in
+ * every attempt's context. Runners that cannot narrow their setup ignore it.
+ */
+type TaskRunnerConfig = 'user' | 'minimal';
 /** A plan task driven over the runner's programmatic protocol (ADR-0018, C1). */
 interface TaskStartOptions extends AgentStartCommon {
     kind: 'task';
@@ -2082,6 +2782,8 @@ interface TaskStartOptions extends AgentStartCommon {
     /** The task's runner mode id, as the plan names it. */
     mode: string;
     flags: TaskRunnerFlags;
+    /** What the runner loads of the user's setup; absent means `user`. */
+    runnerConfig?: TaskRunnerConfig;
     /** The attempt's work lands as a commit (ADR-0047): its completion contract asks for the message. */
     commits?: true;
     /**
@@ -2255,6 +2957,8 @@ interface AgentProcessDeps {
     workspaceEnv?: (cwd: string) => Promise<Record<string, string>>;
     /** Builds the sandbox around a planner's own shell (ADR-0036 N2). Defaults to the host's probe. */
     nativeShellSandbox?: () => PlannerShellSandbox;
+    /** Where a lease put this runner, when not on this host (ADR-0059 L5). */
+    placement?: RunnerPlacement;
 }
 /** Builds the adapter for one runner id, or null when that runner cannot plan. */
 type AgentAdapterFactory = (runner: string, deps: AgentProcessDeps) => AgentAdapter | null;
@@ -2740,7 +3444,7 @@ interface IRunnerSession {
      * The runner's `task_complete` calls on this attempt's token (ADR-0022):
      * the only completion evidence, for `VerdictEngine` to weigh.
      */
-    onTaskComplete(listener: (report: TaskCompleteArgs) => void): void;
+    onTaskComplete(listener: (report: TaskCompleteArgs, refuted?: VerificationCheck) => void): void;
     /**
      * Answers the runner's `checkpoint` calls (ADR-0022, V5): the call stays
      * open until the returned promise settles, and its result is the answer.
@@ -2782,6 +3486,8 @@ interface IRunner {
          * manifest's env still wins over them.
          */
         env?: Record<string, string>;
+        /** A delegated task's attempt (ADR-0055 D3): the task, for {@link ChildPlanRunner} to give its child. */
+        delegated?: Task;
         /** The runner's own session to continue in (ADR-0018, K1). */
         resumeSessionId?: string;
         /** What was counted of that session's running cost before, so its first turn is counted from there. */
@@ -2806,6 +3512,8 @@ interface IRunner {
          * attempt. Runners ignore it; it is for what wraps one to record (task logs).
          */
         skills?: readonly TaskSkillSnapshot[];
+        /** Where the attempt's lease put this runner, when not on this host (ADR-0059 L5). */
+        placement?: RunnerPlacement;
         /** Something the user should know about how the spawn went that did not stop it — a respawn, most often. */
         onNotice?: (message: string) => void;
         /**
@@ -2823,8 +3531,12 @@ interface IRunner {
         cancelled?: AbortSignal;
         /** The attempt's work lands as a commit (ADR-0047): its runner is told to write the message in `task_complete`. */
         commits?: true;
+        /** What the runner loads of the user's own setup (the `taskRunnerConfig` setting); absent means all of it. Runners that cannot narrow it ignore it. */
+        runnerConfig?: TaskRunnerConfig;
         /** A script task's body (ADR-0035): only the script runner reads it, and it runs nothing else. */
         script?: ScriptBody;
+        /** A read-only script's shell (ADR-0055 D8): its body runs sealed there, in the worktree it was cut. */
+        sealed?: TaskShell;
         /**
          * A read-only attempt's shell (ADR-0046): its token serves `run_command`
          * from it, and only an attempt that has one is given that tool.
@@ -2835,12 +3547,14 @@ interface IRunner {
          * arrives (ADR-0047): a refusal is the call's result, and nothing is
          * recorded. Without one, a `task` reference resolves against no plan.
          */
-        checkHandoff?: (completion: TaskCompleteArgs) => HandoffCheck<TaskCompleteArgs>;
+        checkHandoff?: (completion: TaskCompleteArgs) => HandoffCheck<TaskCompleteArgs> | Promise<HandoffCheck<TaskCompleteArgs>>;
         /**
-         * Answers the attempt's `read_task` calls (ADR-0047), against the plan
+         * Answers the attempt's `read` calls (ADR-0047), against the plan
          * and the session's task logs. Without one the call says it is not available.
          */
-        readTask?: (args: ReadTaskArgs) => McpToolReply;
+        readTask?: (args: ReadTaskArgs) => McpToolReply | Promise<McpToolReply>;
+        /** Answers the attempt's `post` calls (ADR-0057 R8). Given only where its plan has a board, which is what lists the tool. */
+        post?: (args: PostArgs) => McpToolReply | Promise<McpToolReply>;
         /**
          * Answers a read-only attempt's `save_patch` calls (ADR-0050): its shell
          * captures the worktree's changes and the attempt keeps them. Without one
@@ -2868,4 +3582,121 @@ interface IRunner {
     activeCount: number;
 }
 
-export { type McpToolContext as $, AUTO_COMMANDS as A, type BashOptions as B, type CatalogModel as C, DEFAULT_PLANNER_ALLOWLIST as D, type DiscoveryCommand as E, type EditPlanArgs as F, type FetchAllProviderModelsOptions as G, type FindSymbolOptions as H, GIT_READONLY_SUBCOMMANDS as I, GREP_DEFAULT_HEAD_LIMIT as J, type GlobOptions as K, type GrepOptions as L, type GrepOutputMode as M, type IApproval as N, type IConfig as O, type IFileSystem as P, type IRunner as Q, type IRunnerSession as R, type InvokedCommand as S, LineBuffer as T, type ListModelsArgs as U, type ListRunnersArgs as V, type LoadSkillArgs as W, type McpClientConfig as X, type McpCredential as Y, type McpRefusal as Z, type McpTool as _, type AgentAdapter as a, type SealedAvailability as a$, type McpToolReply as a0, type MessageTaskArgs as a1, ModelCatalog as a2, type ModelShortcut as a3, ORCHESTRATOR_SHORTCUTS as a4, ORDEWELL_MCP_PATH as a5, ORDEWELL_MCP_SERVER_NAME as a6, type OneTaskArgs as a7, type OrchestratorOption as a8, OrdewellMcpServer as a9, type RunCommandArgs as aA, type RunPlanArgs as aB, type RunnerAuthSpec as aC, type RunnerAuthStatus as aD, type RunnerCommand as aE, type RunnerCommandKind as aF, type RunnerEntry as aG, type RunnerEnv as aH, type RunnerFeatures as aI, type RunnerManifest as aJ, type RunnerMcpServer as aK, type RunnerMode as aL, type RunnerModelDiscovery as aM, type RunnerModelRef as aN, RunnerRegistry as aO, SEALED_LIMITS as aP, SEARCH_EXCLUSIONS as aQ, type SandboxBackend as aR, type SandboxInvocation as aS, type SandboxLaunch as aT, type SandboxLimits as aU, type SandboxProfile as aV, type ScriptBody as aW, type ScriptExit as aX, type ScriptFullOutput as aY, type ScriptRun as aZ, type ScriptStatus as a_, type OwnSealedRuns as aa, type OwnerOnlyFile as ab, PLANNER_EXECUTION_TOOLS as ac, PLANNER_SANDBOX_DOCS as ad, PLANNER_TOOLS as ae, type PlannerAllowlist as af, type PlannerBackendId as ag, type PlannerSandboxAvailability as ah, type PlannerSandboxDeps as ai, PlannerShellSandbox as aj, type PlannerStartOptions as ak, type PlannerTokenScope as al, type PlannerToolHandler as am, type ProjectMcpServer as an, type ProviderCredentialSource as ao, type ProviderModelLists as ap, type ProviderModelsResult as aq, type QueuedTaskMessage as ar, READ_ONLY_TASK_TOOLS as as, REFUSED_COMMANDS as at, type ReadFileOpts as au, type ReadTaskArgs as av, type ResearchShell as aw, type ResearchShellDeps as ax, type RetryTaskArgs as ay, type RuleWord as az, type AgentAdapterFactory as b, type SealedRunOptions as b0, type ShellDialect as b1, type ShellLaunch as b2, type SpawnFn as b3, type StandingDecision as b4, type StructuredEvent as b5, type StructuredTurnEnd as b6, type SubmitPlanArgs as b7, TASK_COMPLETE_TOOL as b8, TASK_COMPLETION_CONTRACT as b9, effectiveApprovalMode as bA, enabledRunners as bB, fetchAllProviderModels as bC, findRunnerCommand as bD, isGranted as bE, isRunnerApproval as bF, knownModelId as bG, mcpClientConfig as bH, ownerOnlyConfigFile as bI, parseAllowlist as bJ, parseApprovalModeSetting as bK, researchShellWarning as bL, researchToolsPath as bM, resolveModelShortcut as bN, resolvePlannerSandbox as bO, resolveProvider as bP, resolveResearchShell as bQ, scopeAllowed as bR, scriptBodyOf as bS, scriptBodyText as bT, scriptTaskText as bU, sharedMcpServer as bV, taskCompletionContract as bW, timeLimitText as bX, toApprovalDecision as bY, toOrchestratorOptions as bZ, toolAllowed as b_, TASK_SEALED_LIMITS as ba, TASK_TOOLS as bb, type TaskCompleteArgs as bc, type TaskDiffArgs as bd, type TaskMessageFrom as be, type TaskModeAgentAdapter as bf, TaskModeUnsupportedError as bg, type TaskOutputArgs as bh, type TaskQueryArgs as bi, type TaskRunCommandArgs as bj, type TaskRunnerFlags as bk, type TaskShell as bl, type TaskShellSite as bm, type TaskStartOptions as bn, type TaskTokenScope as bo, type TaskToolHandler as bp, type TaskWebReads as bq, type ToolOutcome as br, type UsageLimitSignal as bs, approvalScopes as bt, classifyCommand as bu, clearPlannerSandboxCache as bv, clearResearchShellCache as bw, collectProviderCredentials as bx, commandAllowedBy as by, commandLine as bz, type AgentEvent as c, type AgentProcessDeps as d, type AgentStartOptions as e, type AiProvider as f, type AllProviderModels as g, type AnswerApprovalArgs as h, type ApplyPatchArgs as i, type ApprovalAnswer as j, type ApprovalDecision as k, type ApprovalKind as l, type ApprovalMode as m, type ApprovalModeSetting as n, ApprovalPolicy as o, type ApprovalPolicyOptions as p, type ApprovalRequest as q, type ApprovalSource as r, type AttachState as s, type CheckpointAnswer as t, type CheckpointArgs as u, type CommandClassification as v, type CommandTier as w, type CommandWords as x, DEFAULT_SCRIPT_TIMEOUT_MS as y, DENY_ALL as z };
+declare const BOARD_TYPES: readonly ["finding", "claim", "attempt", "artifact", "contract", "assume", "scope_change", "decision", "pin"];
+type BoardEntryType = (typeof BOARD_TYPES)[number];
+/** `file` evidence, with the blobs R9 compares: Ordewell reads both as the entry is posted, so neither is an author's claim. */
+interface BoardFile {
+    kind: 'file';
+    path: string;
+    /** The file as its author had it, where it could be read. */
+    sha?: string;
+    /** What the board's branch held then, absent where it held no such file. */
+    tip?: string;
+}
+/** What an author sends. */
+interface BoardPost {
+    type: BoardEntryType;
+    title: string;
+    detail?: string;
+    /** What `contested` compares (R9): entries with one key and different values. */
+    key?: string;
+    value?: string;
+    files?: string[];
+}
+/** Whose words an entry is, as the token that posted it says and never the entry. */
+interface BoardAuthor {
+    node: NodePath;
+    /** Its task's label in that plan; absent for that plan's planner. */
+    task?: string;
+    attempt?: number;
+}
+interface BoardEntry extends Omit<BoardPost, 'files'> {
+    /** The board it is on, and its number there: together its reference. */
+    node: NodePath;
+    id: number;
+    by: BoardAuthor;
+    at: string;
+    files?: BoardFile[];
+    /** The branch `files` was read against, which is the same for every reader. */
+    branch?: string;
+    /** The entry it was raised from at a landing (R6), which keeps its author. */
+    raisedFrom?: {
+        node: NodePath;
+        id: number;
+    };
+}
+/** An entry as the log is told of it: the ledger numbers it and the clock stamps it. */
+type BoardDraft = Omit<BoardEntry, 'node' | 'id' | 'at'>;
+
+/** `root/3/2`: the ids from the root down. A node's parent never changes, so neither does this. */
+type NodePath = string;
+interface OfNode {
+    /** When it was written: for a reader, and never read by a fold. */
+    at: string;
+    node: NodePath;
+}
+type TreeFact = OfNode & (
+/** A node joined the tree. Below the root its `limit` is carved from its parent, and `kept` of it stays for the subplanner's next turn (ADR-0056 M5). */
+{
+    kind: 'node_opened';
+    sessionId: string;
+    taskId?: string;
+    limit: number;
+    kept: number;
+}
+/** `node` confirmed closed: its parent holds its `limit` no longer, and is charged what it spent. */
+ | {
+    kind: 'node_closed';
+}
+/** Tokens as a runner or planner reported them. A turn spends what its node kept first. */
+ | {
+    kind: 'tokens_spent';
+    tokens: number;
+    turn?: true;
+    taskId?: string;
+    attempt?: number;
+}
+/** A raise: `tokens` more on `node`'s limit, from its parent's room. */
+ | {
+    kind: 'budget_raised';
+    tokens: number;
+}
+/** Its parent's own spending took `tokens` of `node`'s room: `node`'s limit and its parent's `committed` fall together. */
+ | {
+    kind: 'budget_taken';
+    tokens: number;
+}
+/** A subplanner parked, keeping `tokens` more for its next turn. */
+ | {
+    kind: 'reserve_kept';
+    tokens: number;
+}
+/** The user set the root's limit, the tree's budget, to `limit`. */
+ | {
+    kind: 'limit_set';
+    limit: number;
+}
+/** An entry on `node`'s board, whole: a board is a fold of these (ADR-0057 R8). */
+ | {
+    kind: 'board_posted';
+    entry: BoardEntry;
+});
+/** A fact as the log holds it: `seq` is its place in the tree's one order, from 1. */
+type TreeEvent = TreeFact & {
+    seq: number;
+};
+
+/**
+ * One append-only log per root (ADR-0058 S3), behind a port so that a daemon
+ * host can back it with SQLite later. Only the host holding the root's session
+ * lease writes it (ADR-0055 D13).
+ */
+interface EventStore {
+    /** In order, each batch whole: after a crash a reader finds all of a batch or none of it. Numbers them. */
+    append(events: readonly TreeFact[]): Promise<void>;
+    /** What came after the cursor, at `path` and below when one is named. */
+    read(after: number, path?: NodePath): AsyncIterable<TreeEvent>;
+    close(): Promise<void>;
+}
+
+export { type InvokedCommand as $, AUTO_COMMANDS as A, type BashOptions as B, type CatalogModel as C, type CommandClassification as D, type CommandTier as E, ConsoleLogger as F, DENY_ALL as G, type DiscoveryCommand as H, type EditPlanArgs as I, type EventStore as J, type ExecutionBackend as K, type FetchAllProviderModelsOptions as L, type FindSymbolOptions as M, GIT_READONLY_SUBCOMMANDS as N, GREP_DEFAULT_HEAD_LIMIT as O, type GlobOptions as P, type GrepOptions as Q, type GrepOutputMode as R, type Guarantee as S, type GuaranteeReport as T, type IApproval as U, type IConfig as V, type IFileSystem as W, type ILogger as X, type INotification as Y, type IRunner as Z, type IRunnerSession as _, type AgentAdapter as a, type RunnerFeatures as a$, type IsolatedExecution as a0, IsolationRunController as a1, type LeaseRecord as a2, type LeaseRepo as a3, type LeaseRequest as a4, type LeaseSpec as a5, LineBuffer as a6, type ListModelsArgs as a7, type ListRunnersArgs as a8, type LoadSkillArgs as a9, type PlannerSandboxDeps as aA, PlannerShellSandbox as aB, type PlannerStartOptions as aC, type PlannerTokenScope as aD, type PlannerToolHandler as aE, type PostArgs as aF, type ProjectMcpServer as aG, type ProviderCredentialSource as aH, type ProviderModelLists as aI, type ProviderModelsResult as aJ, type QueuedTaskMessage as aK, READ_ONLY_TASK_TOOLS as aL, REFUSED_COMMANDS as aM, type ReadFileOpts as aN, type ReadTaskArgs as aO, type ResearchShell as aP, type ResearchShellDeps as aQ, type ReservedLease as aR, type RetryTaskArgs as aS, type RunCommandArgs as aT, type RunPlanArgs as aU, type RunnerAuthSpec as aV, type RunnerAuthStatus as aW, type RunnerCommand as aX, type RunnerCommandKind as aY, type RunnerEntry as aZ, type RunnerEnv as a_, type McpClientConfig as aa, type McpCredential as ab, type McpRefusal as ac, type McpTool as ad, type McpToolContext as ae, type McpToolReply as af, type MessageTaskArgs as ag, ModelCatalog as ah, type ModelShortcut as ai, type NodePath as aj, type NotificationAction as ak, ORCHESTRATOR_SHORTCUTS as al, ORDEWELL_MCP_PATH as am, ORDEWELL_MCP_SERVER_NAME as an, type OneTaskArgs as ao, type OpenLease as ap, type OrchestratorOption as aq, OrdewellMcpServer as ar, type OwnSealedRuns as as, type OwnerOnlyFile as at, PLANNER_EXECUTION_TOOLS as au, PLANNER_SANDBOX_DOCS as av, PLANNER_TOOLS as aw, type PlannerBackendId as ax, type PlannerModes as ay, type PlannerSandboxAvailability as az, type AgentAdapterFactory as b, fetchAllProviderModels as b$, type RunnerManifest as b0, type RunnerMcpServer as b1, type RunnerMode as b2, type RunnerModelDiscovery as b3, type RunnerModelRef as b4, type RunnerPlacement as b5, RunnerRegistry as b6, SEALED_LIMITS as b7, SEARCH_EXCLUSIONS as b8, type SandboxBackend as b9, type TaskMessageFrom as bA, type TaskModeAgentAdapter as bB, TaskModeUnsupportedError as bC, type TaskOutputArgs as bD, type TaskQueryArgs as bE, type TaskRunCommandArgs as bF, type TaskRunnerConfig as bG, type TaskRunnerFlags as bH, type TaskShell as bI, type TaskShellSite as bJ, type TaskStartOptions as bK, type TaskTokenScope as bL, type TaskToolHandler as bM, type TaskWebReads as bN, type ToolOutcome as bO, type TreeEvent as bP, type TreeFact as bQ, type UsageLimitSignal as bR, approvalScopes as bS, classifyCommand as bT, clearPlannerSandboxCache as bU, clearResearchShellCache as bV, collectProviderCredentials as bW, defaultLogger as bX, deleteSession as bY, effectiveApprovalMode as bZ, enabledRunners as b_, type SandboxInvocation as ba, type SandboxLaunch as bb, type SandboxLimits as bc, type SandboxProfile as bd, type ScriptExit as be, type ScriptFullOutput as bf, type ScriptRun as bg, type ScriptStatus as bh, type SealedAvailability as bi, type SealedRunOptions as bj, type SessionData as bk, type SessionMeta as bl, type ShellDialect as bm, type ShellLaunch as bn, type SkillLookup as bo, type SpawnFn as bp, type StandingDecision as bq, type StructuredEvent as br, type StructuredTurnEnd as bs, type SubmitPlanArgs as bt, TASK_COMPLETE_TOOL as bu, TASK_COMPLETION_CONTRACT as bv, TASK_SEALED_LIMITS as bw, TASK_TOOLS as bx, type TaskCompleteArgs as by, type TaskDiffArgs as bz, type AgentEvent as c, findRunnerCommand as c0, getLatestSession as c1, idSegment as c2, isGranted as c3, isRunnerApproval as c4, knownModelId as c5, listChildSessions as c6, listSessions as c7, loadChildSession as c8, loadSession as c9, loadSessionPlanState as ca, mcpClientConfig as cb, ownerOnlyConfigFile as cc, parseApprovalModeSetting as cd, plannerToolSet as ce, researchShellWarning as cf, researchToolsPath as cg, resolveModelShortcut as ch, resolvePlannerSandbox as ci, resolveProvider as cj, resolveResearchShell as ck, saveChildSession as cl, saveSession as cm, sessionDataDir as cn, sharedMcpServer as co, taskCompletionContract as cp, taskToolSet as cq, toApprovalDecision as cr, toOrchestratorOptions as cs, toolListing as ct, type AgentProcessDeps as d, type AgentStartOptions as e, type AiProvider as f, type AllProviderModels as g, type AnswerApprovalArgs as h, type ApplyPatchArgs as i, type ApprovalAnswer as j, type ApprovalDecision as k, type ApprovalKind as l, type ApprovalMode as m, type ApprovalModeSetting as n, ApprovalPolicy as o, type ApprovalPolicyOptions as p, type ApprovalRequest as q, type ApprovalSource as r, type AttachState as s, type BoardAuthor as t, type BoardDraft as u, type BoardEntry as v, type BoardPost as w, type CheckpointAnswer as x, type CheckpointArgs as y, type ChildSessionPlace as z };